Violent attacks targeting cryptocurrency holders surged in the first half of 2026, with more than $30 million stolen worldwide, according to blockchain analytics firm Chainalysis. The report, released on Thursday, highlights a record pace for such crimes this year.
USDT
AAPLSpike in home invasions and kidnappings
Chainalysis documented 46 incidents involving armed robberies, kidnappings, home invasions, and hostage situations through late June. Together, these incidents led to significant financial losses for victims, as criminals increasingly view crypto holders as lucrative targets with assets that can be transferred instantly.
The firm reported: “Violent attacks targeting crypto holders, including home invasions, kidnappings, and hostage situations, sometimes called ‘wrench attacks’ in security circles, have surged in recent years. Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form.”
A wrench attack involves using threats or physical force to compel victims to transfer cryptocurrency. While kidnappings remain common, home invasions now account for 37% of documented incidents, up from 26% in 2023. Attackers are also increasingly targeting victims’ relatives and acquaintances to coerce the transfer of digital assets.
Chainalysis stated that home invasions allow criminals to operate in a controlled environment, making it easier to force victims to act, while kidnappings demand extensive planning and expose perpetrators to greater risks over time.
Mini dictionary: Wrench attack, a term used in crypto security to describe physical attacks where criminals use direct violence or threats to force victims into revealing and transferring their digital assets.
France sees surge in attacks amid data breach
France recorded 30 publicly known wrench attacks through mid-2026, ranking first globally, according to Chainalysis. The analytics firm tied the surge to an alleged breach of tax records that exposed identities and financial information of crypto holders, leading to an uptick in attacks by organized criminal groups.
Authorities in France responded by expanding investigations, and in April, prosecutors charged 88 suspects, including more than 10 minors, across 12 separate operations targeting these violent gangs.
In June, a French man was indicted for allegedly participating in a wrench attack by impersonating a police officer. Convictions in the UK also made headlines this week, after five men were found guilty of imprisoning and torturing two French cryptocurrency millionaires in London as part of an extortion attempt.
| Country | Documented Wrench Attacks (Jan–Jun 2026) |
|---|---|
| France | 30 |
| Other countries | 16 |
Attackers employ diverse laundering methods
Chainalysis observed notable differences in the sophistication of attackers when moving stolen crypto. Some criminals immediately transfer assets to centralized exchanges, leaving clear trails, while others make use of decentralized platforms, bridges, and automated trading tools to obfuscate funds and evade detection.
The firm noted: “Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains. They understand that centralized exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them.”
Mini dictionary: MEV bots, specialized software that extracts additional value from blockchain transactions by exploiting differences in transaction ordering within decentralized finance protocols.
Recent cases and wider context
Recent months have seen several high-profile attacks make international headlines. In February, blockchain security firm CertiK reported a 75% rise in wrench attacks in 2025, reaching a record 72 incidents, with France as the epicenter.
CertiK also estimated financial exposure from wrench attacks soared to $124 million globally in the first half of 2026. Meanwhile, in the U.S., Bitcoin ransom demands have surfaced in several high-profile incidents, including the kidnapping of “Today” show host Savannah Guthrie’s mother.
Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form, according to Chainalysis. They increasingly target victims’ relatives and use both basic and sophisticated laundering techniques after the attacks.
